CVE-2020-12049

MEDIUM

dbus 1.3.0-1.12.17 - Denial of Service via File Descriptor Leak

Title source: llm
STIX 2.1

Description

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

References (10)

Core 10
Core References
Third Party Advisory vendor-advisory
https://usn.ubuntu.com/4398-1/
Third Party Advisory vendor-advisory
https://usn.ubuntu.com/4398-2/
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202007-46
Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/04/3

Scores

CVSS v3 5.5
EPSS 0.0009
EPSS Percentile 25.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-404
Status published
Products (7)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.10
canonical/ubuntu_linux 20.04
freedesktop/dbus 1.3.0 - 1.12.18
Published Jun 08, 2020
Tracked Since Feb 18, 2026